On the recordRead 11 Oct 202612 facts
pip-audit
Plans and prices
pip-audit
Free
Open-source Python vulnerability auditing tool
Read 11 Oct 2026 · github.com
On the record
- Advisory sources
- It can check vulnerabilities using PyPI or OSV services.github.com · read 11 Oct 2026
- Automatic fixes
- The --fix option can automatically upgrade vulnerable dependencies.github.com · read 11 Oct 2026
- Input limitations
- It does not process Pipfile or Pipfile.lock directly; the project suggests converting them to a supported requirements file.github.com · read 11 Oct 2026
- Installation
- The project says pip-audit requires Python 3.10 or newer and can be installed with pip; it also lists conda-forge as an installation option.github.com · read 11 Oct 2026
- Integrations
- The project provides an official GitHub Action and supports pre-commit.github.com · read 11 Oct 2026
- License
- pip-audit is licensed under Apache 2.0.github.com · read 11 Oct 2026
- Output formats
- Audit results can be emitted as columns, Markdown, JSON, CycloneDX JSON, or CycloneDX XML.github.com · read 11 Oct 2026
- Private indexes
- Interactive authentication to third-party package indexes is unsupported; pip keyring authentication is supported with limitations.github.com · read 11 Oct 2026
- Purpose
- Audits Python environments, requirements files, and dependency trees for known security vulnerabilities.github.com · read 11 Oct 2026
- SBOM output
- It can emit CycloneDX SBOMs in XML or JSON.github.com · read 11 Oct 2026
- Security scope
- It analyzes dependency trees, not source code, and does not claim to defend against malicious packages.github.com · read 11 Oct 2026
- Vulnerability limitations
- The project cautions that vulnerability feeds may contain noisy reports and that vulnerabilities in shared libraries may not be detected.github.com · read 11 Oct 2026
